The show down, manual versus automated testing.
What is automated testing, or what is automated security testing?
Well, automated tests are tests that run without any manual intervention,
completely automatic, autonomous.
It can be static, as well as dynamic testing.
Both can be performed manual, as well as automatic.
And it can be remote,
so centralized in one location where all the tests are being performed,
as well as local.
Again, there's no difference between manual tests and automated tests.
Automated security testing is usually integrated into build pipelines.
That's the location where you see it most often.
In the course, Integrating Automated Security Testing Tools,
you'll see how to integrate automated security
testing into your build pipelines.
A feature of automated security testing is that it's mainly negative testing.
So you're not testing for a specific outcome,
you don't have specific inputs looking for a set outcome,
but you're looking at unexpected things,
abuse casings, errors, as we saw in an earlier clip.
Those are all traits of automated security testing.
And if you compare the two, what would you see?
Well, an example of a manual security test would be a code review,
where one developer refused the code of somebody else.
The automated version would be source code scanning tools.
The same with a check on credentials.
You can do that manually, check for passwords or,
say, secrets, API keys in your code.
The automated example would be pre-commit git hook tools,
which check for those credentials automatically.
A manual security test would be a penetration test.
An automated version would be vulnerability scanning or
dynamic application security testing.
Another interesting example is when you use third-party source code.
Say you want to use a new component,
and you're not completely familiar with the source,
who wrote it, then you try to establish the trustworthiness of the code by,
say, go to GitHub and look at the developer or the party behind it.
So that was a way how you manually establish some form of trustworthiness.
The automated version would be the third-party trust verification.
When you use a module, for instance, then it has a signature,
and you can verify the signature with a third party.
We'll dive deeper into the pros and cons in the next module.
What's important to know,
that automated testing is not a drop-in replacement for manual testing.
It's not that you can replace all manual tests by automated tests.
It's different.
This graph shows you how you spend time with a tool.
And it's an over simplification,
but usually the total time you spend with a tool is only
made up by 20% of the tool itself.
The rest, 80%, is actually you, the human,
spending time configuring the tool, installing it,
running it.
Even though using tools will save you time,
you still need to budget time for actually configuring the tool.
It's not just the tool itself.
The last clip of this module will summarize all that we've seen in this module.